在 Firefox 中发现多个安全问题。如果用户受到诱骗打开特制的网站，攻击者可能利用这些问题造成拒绝服务、读取未初始化内存、获取敏感信息、绕过同源限制、绕过 CSP 保护、绕过混合内容阻碍、伪造地址栏，或执行任意代码。（CVE-2017-7826、CVE-2017-7827、CVE-2017-7828、CVE-2017-7830、CVE-2017-7831、CVE-2017-7832、CVE-2017-7833、CVE-2017-7834、CVE-2017-7835、CVE-2017-7837、CVE-2017-7838、CVE-2017-7842）

发现带有嵌入式选项卡字符的 javascript: URL 在一些情况下将被执行而不是阻止。如果用户受到诱骗复制特制 URL 到地址栏，攻击者可能利用此问题进行跨站脚本 (XSS) 攻击。(CVE-2017-7839)

发现导出的书签未能从用户提供的标签中删除脚本元素。如果用户受到诱骗在书签中加入特制标签，导出标签然后打开产生的 HTML 文件，攻击者可能利用此问题进行跨站脚本 (XSS) 攻击。(CVE-2017-7840)

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

此更新将 Firefox 升级到版本 52.5.0 ESR。安全修复：- 在处理畸形的 Web 内容时发现多个缺陷。包含恶意内容的网页可导致 Firefox 崩溃，或者可能以运行 Firefox 的用户的权限执行任意代码。(CVE-2017-7826, CVE-2017-7828, CVE-2017-7830)

在 Thunderbird 中发现多个安全问题。如果用户受到诱骗在类似浏览环境下打开特制的网站，攻击者可能利用这些漏洞绕过同源限制、通过应用程序崩溃造成拒绝服务，或者执行任意代码。（CVE-2017-7826、CVE-2017-7828、CVE-2017-7830）

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

已在 Mozilla Thunderbird 邮件客户端中发现多个安全问题：多个内存安全错误、释放后使用和其他实现错误可能导致崩溃或执行任意代码。对于 Debian 7“Wheezy”，这些问题已在 1:52.5.0-1~deb7u1 版本中修复。我们建议您升级 thunderbird 程序包。注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动整理和排版。

已在 Mozilla Firefox Web 浏览器中发现数个安全问题：多个内存安全错误、释放后使用和其他实现错误可能导致执行任意代码、拒绝服务或绕过同源策略。

远程 macOS 或 Mac OS X 主机上安装的 Mozilla Firefox ESR 版本低于 52.5。因而会受到多个漏洞的影响，其中一些漏洞允许代码执行，并可能导致可遭利用的崩溃。

远程 macOS 或 Mac OS X 主机上安装的 Mozilla Firefox 版本低于 57。因而会受到多个漏洞的影响，其中一些漏洞允许代码执行，并可能导致可遭利用的应用程序崩溃。

来自 Red Hat 安全公告 2017:3247： firefox 更新现可用于 Red Hat Enterprise Linux 6 和 Red Hat Enterprise Linux 7。 Red Hat 产品安全团队已将此更新评级为具有重大安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。 Mozilla Firefox 是一款开源网页浏览器。 此更新将 Firefox 升级到版本 52.5.0 ESR。 安全补丁： * 在处理畸形 Web 内容时发现多个缺陷。包含恶意内容的网页可导致 Firefox 崩溃，或者可能以运行 Firefox 的用户的权限执行任意代码。(CVE-2017-7826, CVE-2017-7828, CVE-2017-7830) Red Hat 在此感谢 Mozilla 项目报告这些问题。上游感谢原始报告者 Christian Holler、David Keeler、Jon Coppeard、Julien Cristau、Jan de Mooij、Jason Kratzer、Philipp、Nicholas Nethercote、Oriol Brufau、Andre Bargull、Bob Clary、Jet Villegas、Randell Jesup、Tyson Smith、Gary Kwong、Ryan VanderMeulen、Nils 和 Jun Kokatsu。

thunderbird 的更新现可用于 Red Hat Enterprise Linux 6 和 Red Hat Enterprise Linux 7。Red Hat 产品安全团队将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。Mozilla Thunderbird 是独立的邮件和新闻组客户端。此更新将 Thunderbird 升级到版本 52.5.0。安全修复：* 在处理畸形 Web 内容时发现多个缺陷。包含恶意内容的网页可能导致 Thunderbird 崩溃，或者可能以运行 Thunderbird 的用户的权限执行任意代码。（CVE-2017-7826、CVE-2017-7828、CVE-2017-7830）Red Hat 在此感谢 Mozilla 项目报告这些问题。上游感谢原始报告者 Christian Holler、David Keeler、Jon Coppeard、Julien Cristau、Jan de Mooij、Jason Kratzer、Philipp、Nicholas Nethercote、Oriol Brufau、Andre Bargull、Bob Clary、Jet Villegas、Randell Jesup、Tyson Smith、Gary Kwong、Ryan VanderMeulen、Nils 和 Jun Kokatsu。

运行版本 MAIN 4.05 的远程 NewStart CGSL 主机安装有受多个漏洞影响的 firefox 程序包：- 使用 blob: 和数据解码的文件下载：尽管存在钓鱼和恶意软件保护功能及其可疑站点和文件的阻止列表，URL 元素仍可绕过正常文件下载检查。这会造成恶意站点诱使用户下载本应检测为可疑的可执行文件。该漏洞影响 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7814) - 当调整图像对象大小时，如果调整大小期间引用的对象已经从内存中释放，则在设计模式中可能出现释放后使用漏洞。这会导致潜在可利用的崩溃。该漏洞影响 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7819) - 内容安全策略 (CSP) 沙盒指令未创建文档的唯一来源，造成其表现为似乎总是指明 allow-same-origin 关键字。这会允许从不安全的内容发起跨站脚本 (XSS) 攻击。该漏洞影响 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7823) - 当在树遍历期间过早删除编辑器 DOM 节点，并且仍然与文件绑定时，可能出现释放后使用漏洞。这会导致潜在可利用的崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7809) - Firefox 54、Firefox ESR 52.2 和 Thunderbird 52.2 中已报告内存安全错误。有迹象表明其中某些错误可导致内存损坏，我们推测若攻击者有意操控，就能利用其中部分错误来运行任意代码。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7779) - 当使用缓存的样式数据将样式规则应用于伪元素（例如 ::first-line）时出现越界读取。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7753) - 当在 DOM 内操纵可访问富互联网应用程序 (ARIA) 属性时，可能出现缓冲区溢出。这会导致潜在可利用的崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7785) - 当图像渲染器尝试绘制不可显示的 SVG 元素时，可能出现缓冲区溢出。这会导致潜在可利用的崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7786) - 在页面重新加载期间，可以在含有内嵌的 iframe 页面上绕过同源策略保护，允许 iframes 在顶级页面上访问内容，导致信息泄露。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7787) - 如果证书中拥有极长的对象标识符 (OID)，当在证书管理器中查看证书时，将会发生缓冲区溢出。这会导致潜在可利用的崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7792) - 在包含 iframe 的页面，data: 协议可用于创建模态警告，将在页面导航后在任意域上呈现，欺骗来自 iframe 内容的模态警告来源。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7791) - 当保持连接的对象在断开连接操作完成前释放，在 WebSockets 中可能出现释放后使用漏洞。这会导致可利用的崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7800) - 开发人员工具功能受到 XUL 注入漏洞影响，原因在于不当清理 Web 页面源代码。在最糟糕的情况下，当打开带有样式编辑器工具的恶意页面时，可允许任意代码执行。该漏洞影响 Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7798) - 在调整图像元素大小的事件期间，操纵 DOM 时可能出现释放后使用漏洞。如果由于缺少强引用造成已经释放此类元素，当访问已经释放的元素时，可能出现潜在的可利用崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7802) - 当更新的样式对象在仍使用时遭到释放，在窗口调整大小期间，重新计算 marquee 元素的布局时，可能出现释放后使用漏洞。这会导致潜在可利用的崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7801) - 一种机制使用 AppCache 劫持域中的 URL，从域中的子路径通过提供文件来使用回退。已经通过要求将回退文件放在清单目录中来解决此问题。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7807) - 当页面的内容安全策略 (CSP) 标头包含沙盒指令时，会忽略其他指令。这会导致不正确执行 CSP。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7803) - 在已经释放观察者后，在帧重建期间，当读取图像观察者时，可能出现释放后使用漏洞。这会导致潜在可利用的崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7784) - 当通过 DOM 在容器内操纵可访问富互联网应用程序 (ARIA) 元素的数组时，可能出现释放后使用漏洞。这会导致潜在可利用的崩溃。该漏洞影响 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7818) - 以用于 WebGL 内容的 ANGLE 图库绘制及验证元素时，会发生缓冲区溢出情况。这是由于在检查期间在库内传递不正确的值所致，并导致潜在可利用的崩溃。该漏洞影响 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7824) - Firefox 55 和 Firefox ESR 52.3 中已报告内存安全错误。有迹象表明其中某些错误可导致内存损坏，我们推测若攻击者有意操控，就能利用其中部分错误来运行任意代码。该漏洞影响 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7810) - 当工作进程或相关窗口在仍使用时遭到释放，Fetch API 中会发生释放后使用漏洞，导致潜在的可利用崩溃。该漏洞影响 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7793) - 在 Firefox 中发现隐私缺陷。在私人浏览模式下，工作线程可将持久性数据写入 IndexedDB，该数据在退出时不会被清除，并且会在多个会话间持久保存。恶意网站可利用此缺陷绕过隐私浏览保护和唯一指纹访客。(CVE-2017-7843) - 刷新和调整布局大小时出现释放后使用漏洞，原因在于 PressShell 对象在仍然使用时已经释放。这会导致在此类操作中造成潜在可利用的崩溃。该漏洞影响 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7828) - Firefox 56 和 Firefox ESR 52.4 中已报告内存安全错误。有迹象表明其中某些错误可导致内存损坏，我们推测若攻击者有意操控，就能利用其中部分错误来运行任意代码。该漏洞影响 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7826) - Resource Timing API 错误显示了跨源 iframe 中的导航。这是同源策略违规，可能导致用户加载的 URL 数据遭窃。该漏洞影响 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7830) 请注意，Nessus 并未针对此问题进行测试，而仅依赖应用程序自我报告的版本号。

运行版本 MAIN 4.05 的远程 NewStart CGSL 主机安装有受多个漏洞影响的 thunderbird 程序包：- 使用 blob: 和数据解码的文件下载：尽管存在钓鱼和恶意软件保护功能及其可疑站点和文件的阻止列表，URL 元素仍可绕过正常文件下载检查。这会造成恶意站点诱使用户下载本应检测为可疑的可执行文件。该漏洞影响 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7814) - 当调整图像对象大小时，如果调整大小期间引用的对象已经从内存中释放，则在设计模式中可能出现释放后使用漏洞。这会导致潜在可利用的崩溃。该漏洞影响 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7819) - 内容安全策略 (CSP) 沙盒指令未创建文档的唯一来源，造成其表现为似乎总是指明 allow-same-origin 关键字。这会允许从不安全的内容发起跨站脚本 (XSS) 攻击。该漏洞影响 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7823) - 当在树遍历期间过早删除编辑器 DOM 节点，并且仍然与文件绑定时，可能出现释放后使用漏洞。这会导致潜在可利用的崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7809) - Firefox 54、Firefox ESR 52.2 和 Thunderbird 52.2 中已报告内存安全错误。有迹象表明其中某些错误可导致内存损坏，我们推测若攻击者有意操控，就能利用其中部分错误来运行任意代码。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7779) - 当使用缓存的样式数据将样式规则应用于伪元素（例如 ::first-line）时出现越界读取。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7753) - 当在 DOM 内操纵可访问富互联网应用程序 (ARIA) 属性时，可能出现缓冲区溢出。这会导致潜在可利用的崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7785) - 当图像渲染器尝试绘制不可显示的 SVG 元素时，可能出现缓冲区溢出。这会导致潜在可利用的崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7786) - 在页面重新加载期间，可以在含有内嵌的 iframe 页面上绕过同源策略保护，允许 iframes 在顶级页面上访问内容，导致信息泄露。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7787) - 如果证书中拥有极长的对象标识符 (OID)，当在证书管理器中查看证书时，将会发生缓冲区溢出。这会导致潜在可利用的崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7792) - 在包含 iframe 的页面，data: 协议可用于创建模态警告，将在页面导航后在任意域上呈现，欺骗来自 iframe 内容的模态警告来源。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7791) - 当保持连接的对象在断开连接操作完成前释放，在 WebSockets 中可能出现释放后使用漏洞。这会导致可利用的崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7800) - 在调整图像元素大小的事件期间，操纵 DOM 时可能出现释放后使用漏洞。如果由于缺少强引用造成已经释放此类元素，当访问已经释放的元素时，可能出现潜在的可利用崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7802) - 当更新的样式对象在仍使用时遭到释放，在窗口调整大小期间，重新计算 marquee 元素的布局时，可能出现释放后使用漏洞。这会导致潜在可利用的崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7801) - 一种机制使用 AppCache 劫持域中的 URL，从域中的子路径通过提供文件来使用回退。已经通过要求将回退文件放在清单目录中来解决此问题。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7807) - 当页面的内容安全策略 (CSP) 标头包含沙盒指令时，会忽略其他指令。这会导致不正确执行 CSP。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7803) - 在已经释放观察者后，在帧重建期间，当读取图像观察者时，可能出现释放后使用漏洞。这会导致潜在可利用的崩溃。此漏洞会影响 Thunderbird < 52.3、Firefox ESR < 52.3 和 Firefox < 55。(CVE-2017-7784) - 当通过 DOM 在容器内操纵可访问富互联网应用程序 (ARIA) 元素的数组时，可能出现释放后使用漏洞。这会导致潜在可利用的崩溃。该漏洞影响 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7818) - 以用于 WebGL 内容的 ANGLE 图库绘制及验证元素时，会发生缓冲区溢出情况。这是由于在检查期间在库内传递不正确的值所致，并导致潜在可利用的崩溃。该漏洞影响 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7824) - Firefox 55 和 Firefox ESR 52.3 中已报告内存安全错误。有迹象表明其中某些错误可导致内存损坏，我们推测若攻击者有意操控，就能利用其中部分错误来运行任意代码。该漏洞影响 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7810) - 当工作进程或相关窗口在仍使用时遭到释放，Fetch API 中会发生释放后使用漏洞，导致潜在的可利用崩溃。该漏洞影响 Firefox < 56、Firefox ESR < 52.4 和 Thunderbird < 52.4。(CVE-2017-7793) - 刷新和调整布局大小时出现释放后使用漏洞，原因在于 PressShell 对象在仍然使用时已经释放。这会导致在此类操作中造成潜在可利用的崩溃。该漏洞影响 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7828) - Firefox 56 和 Firefox ESR 52.4 中已报告内存安全错误。有迹象表明其中某些错误可导致内存损坏，我们推测若攻击者有意操控，就能利用其中部分错误来运行任意代码。该漏洞影响 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7826) - Resource Timing API 错误显示了跨源 iframe 中的导航。这是同源策略违规，可能导致用户加载的 URL 数据遭窃。该漏洞影响 Firefox < 57、Firefox ESR < 52.5 和 Thunderbird < 52.5。(CVE-2017-7830) 请注意，Nessus 并未针对此问题进行测试，而仅依赖应用程序自我报告的版本号。

远程主机受到 GLSA-201803-14 中所述漏洞的影响（Mozilla Thunderbird：多个漏洞）在 Mozilla Thunderbird 中发现多个漏洞。如需详细信息，请查看以下供参考的 Mozilla 基础安全公告和 CVE 标识符。影响：远程攻击者可能能够执行任意代码、造成拒绝服务情况、取得敏感信息、进行 URL 劫持或发动跨站脚本 (XSS) 攻击。解决方法：目前无任何已知的解决方法。

Versions of Mozilla Firefox ESR earlier than 52.5 are unpatched for the following vulnerabilities :

 - A flaw exists in the 'NewReactionRecord()' function in 'js/src/builtin/Promise.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'VerifyCMSDetachedSignatureIncludingCertificate()' function in 'security/manager/ssl/nsDataSignatureVerifier.cpp' that is triggered when handling PKCS#7 signedData content. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ContainerLayerComposite::mPrepared()' function in 'gfx/layers/composite/ContainerLayerComposite.cpp' that is triggered when handling layers. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'MArgumentsLength::computeRange()' function in 'js/src/jit/RangeAnalysis.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'widget/windows/AudioSession.cpp' that is triggered when handling AudioSession objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered when handling WebGL texture images. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'nsDocShell::~nsDocShell()' function in 'docshell/base/nsDocShell.cpp' that is triggered when notifying observers. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'CleanupOSFileConstants()' function in 'dom/system/OSFileConstants.cpp' related to use of uninitialized memory. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'ApplicationReputationService::~ApplicationReputationService()' function in 'toolkit/components/downloads/ApplicationReputation.cpp' that is triggered as certain pointers are not properly cleared. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'EnumerableOwnProperties()' function in 'js/src/builtin/Object.cpp' that is triggered when rooting objects. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'CompositorBridgeChild::RecvDidComposite()' function in 'gfx/layers/ipc/CompositorBridgeChild.cpp' that is triggered when handling texture pools. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsViewManager::~nsViewManager()' function in 'view/nsViewManager.cpp' that is triggered as the PresShell object is not properly handled. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TLSFilterTransaction::Close()' function in 'netwerk/protocol/http/TunnelUtils.cpp' that is triggered as timers are not properly handled when a transaction is canceled. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'EventStateManager::DispatchCrossProcessEvent()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling drag events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered when handling properties of adopted nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'PropertyReadNeedsTypeBarrier()' function in 'jit/MIR.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A logic flaw exists in the 'IsMarkedBlack()' function in 'js/src/gc/Barrier.cpp' that is triggered during gray marking asserts. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that triggered when flushing and resizing the layout, which may cause the PressShell object to be freed while still in use. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'HttpBaseChannel::GetPerformance()' function in 'netwerk/protocol/http/HttpBaseChannel.cpp' that is triggered as navigations in cross-origin iframes are revealed. Using the Resource Timing API, a context-dependent attacker to gain access to cross-origin URL information.

Versions of Mozilla Firefox earlier than 57 are unpatched for the following vulnerabilities :

 - A race condition exists in 'dom/media/systemservices/MediaParent.cpp' that is triggered when getting deviceId keys. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in 'js/src/proxy/DeadObjectProxy.cpp' that is triggered when handling object proxies. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'xpcom/threads/SystemGroup.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An overflow condition exists in the 'nr_transport_addr_fmt_ifname_addr_string()' function in 'media/mtransport/third_party/nICEr/src/net/transport_addr.c' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to cause a stack-based buffer overflow and potentially execute arbitrary code.
 - A flaw exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'GPUProcessHost::OnChannelClosed()' function in 'gfx/ipc/GPUProcessHost.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists in 'gfx/layers/AtomicRefCountedWithFinalize.h' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'NewReactionRecord()' function in 'js/src/builtin/Promise.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'VerifyCMSDetachedSignatureIncludingCertificate()' function in 'security/manager/ssl/nsDataSignatureVerifier.cpp' that is triggered when handling PKCS#7 signedData content. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'ContainerLayerComposite::mPrepared()' function in 'gfx/layers/composite/ContainerLayerComposite.cpp' that is triggered when handling layers. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'MArgumentsLength::computeRange()' function in 'js/src/jit/RangeAnalysis.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'widget/windows/AudioSession.cpp' that is triggered when handling AudioSession objects. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered when handling WebGL texture images. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'nsDocShell::~nsDocShell()' function in 'docshell/base/nsDocShell.cpp' that is triggered when notifying observers. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'CleanupOSFileConstants()' function in 'dom/system/OSFileConstants.cpp' related to use of uninitialized memory. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'ApplicationReputationService::~ApplicationReputationService()' function in 'toolkit/components/downloads/ApplicationReputation.cpp' that is triggered as certain pointers are not properly cleared. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'EnumerableOwnProperties()' function in 'js/src/builtin/Object.cpp' that is triggered when rooting objects. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free flaw exists in the 'CompositorBridgeChild::RecvDidComposite()' function in 'gfx/layers/ipc/CompositorBridgeChild.cpp' that is triggered when handling texture pools. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsViewManager::~nsViewManager()' function in 'view/nsViewManager.cpp' that is triggered as the PresShell object is not properly handled. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'TLSFilterTransaction::Close()' function in 'netwerk/protocol/http/TunnelUtils.cpp' that is triggered as timers are not properly handled when a transaction is canceled. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'EventStateManager::DispatchCrossProcessEvent()' function in 'dom/events/EventStateManager.cpp' that is triggered when handling drag events. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A flaw exists in the 'nsNodeUtils::CloneAndAdopt()' function in 'dom/base/nsNodeUtils.cpp' that is triggered when handling properties of adopted nodes. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'PropertyReadNeedsTypeBarrier()' function in 'jit/MIR.cpp' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A logic flaw exists in the 'IsMarkedBlack()' function in 'js/src/gc/Barrier.cpp' that is triggered during gray marking asserts. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists that triggered when flushing and resizing the layout, which may cause the PressShell object to be freed while still in use. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - A flaw exists in the 'HttpBaseChannel::GetPerformance()' function in 'netwerk/protocol/http/HttpBaseChannel.cpp' that is triggered as navigations in cross-origin iframes are revealed. Using the Resource Timing API, a context-dependent attacker to gain access to cross-origin URL information.
 - A flaw exists that is triggered as the security wrapper fails to deny access to certain exposed properties using the deprecated exposedProps mechanism on proxy objects. This may allow a context-dependent attacker to gain access to potentially sensitive information.
 - A flaw exists in the 'nsIDNService::isLabelSafe()' function in 'netwerk/dns/nsIDNService.cpp' that is triggered during the handling of the combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave. This combinations do not display properly in punycode. With a specially crafted domain including a dotless version of  'i', a context-dependent attacker can spoof a domain.
 - A flaw exists in the 'nsIDNService::isLabelSafe()' function in 'netwerk/dns/nsIDNService.cpp' that is triggered during the handling of Arabic and Indic vowel marker characters that are combined with Latin characters in a domain name, which can cause the non-latin characters to be eclipsed in the address bar. This may allow a context-dependent attacker to spoof a domain.
 - A flaw exists that is triggered as data: URLs loaded into new tabs do not properly inherit the Content Security Policy (CSP) of the original page. This may allow a context-dependent attacker to bypass protection mechanisms.
 - A flaw exists in the 'nsMixedContentBlocker::AsyncOnChannelRedirect()' function in 'dom/security/nsMixedContentBlocker.cpp' that is triggered as mixed content blocking was not properly applied to resources when being redirected from an HTTPS environment to an HTTP environment. This may allow a context-dependent attacker to bypass restricts and load blocked content on pages.
 - A flaw exists in the 'CurlWrapper::Init()' function in 'toolkit/components/telemetry/pingsender/pingsender_unix_common.cpp' that is triggered as it fails to validate the libcurl library before loading it. This may allow a local attacker to replace libcurl files and gain elevated privileges.
 - A flaw exists in the 'nsContentSink::ProcessMETATag()' function in 'dom/base/nsContentSink.cpp' that is triggered during the handling of <meta> tags in SVG passed via <img> tags. This may allow a context-dependent attacker to set cookies for a page.
 - A flaw exists in 'netwerk/dns/nsIDNService.cpp' that is triggered as Punycode format text is not properly displayed in international domain names when triggered by a sub-domain. This may allow a context-dependent attacker to conduct a limited spoofing attack.
 - A flaw exists in the 'stripUnsafeProtocolOnPaste()' function in 'base/content/browser.js' that is triggered during the handling of control characters before javascript: URLs. This may allow a context-dependent attacker to bypass self-XSS protection mechanisms.
 - A flaw exists in the '_writeItem()' function in 'toolkit/components/places/BookmarkHTMLUtils.jsm' that allows a cross-site scripting (self-XSS) attack. This flaw exists exists because the program does not validate input to exported bookmarks before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in their own browser.
 - A flaw exists that is triggered as the referrer policy is not always honored when handling <link> elements. This may allow a context-dependent attacker to bypass the referrer policy.
 - A flaw exists in the 'PerDocumentStyleDataImpl::visited_styles_enabled()' function in 'servo/components/style/gecko/data.rs'. The issue is triggered when handling the CSS ':visited' selector for a document being used as an SVG image. With a specially crafted web page, a context-dependent attacker disclose visited history information.
 - A flaw exists in the 'FactoryOp::CheckPermission()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered as a web worker in Private Browsing mode can write to IndexedDB. With a specially crafted web page, a context-dependent attacker can uniquely fingerprint a user even when browsing in Private Browsing mode.
 - An overflow condition exists that is triggered as certain input is not properly validated when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library. This may allow a context-dependent attacker to cause a buffer overflow and potentially execute arbitrary code.
 - A flaw exists related to speculative execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached during conditional branches handling out-of-bounds checks. Using a vulnerable code pattern, or a JIT engine or interpreter to generate such a pattern, an attacker can perform a Flush+Reload or Evict+Reload side-channel attack on the cache and disclose parts of the privileged kernel memory.
 - A flaw exists in the fundamental design related to out-of-order process execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached before exceptions are raised for restricted memory access. Using transient instructions in combination with a Flush+Reload side-channel attack a local attacker can disclose parts of the privileged kernel memory.
 - A flaw exists related to speculative execution, which is used as a performance feature to speed up operations. This optimization can result in memory being cached during indirect branch prediction. This may allow a local attacker to train the Branch Target Buffer (BTB) to trigger a false prediction to a specially crafted memory location, causing a speculative execution of a crafted gadget and the caching of arbitrary memory. Using a side-channel attack on the cache the attacker can disclose parts of the privileged kernel memory.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
104652	Ubuntu 14.04 LTS / 16.04 LTS：Firefox 漏洞 (USN-3477-1)	Nessus	Ubuntu Local Security Checks	2017/11/17	2024/8/27	critical
104701	Scientific Linux 安全更新：SL6.x、SL7.x i386/x86_64 中的 firefox	Nessus	Scientific Linux Local Security Checks	2017/11/20	2021/1/14	critical
104995	Ubuntu 14.04 LTS / 16.04 LTS：Thunderbird 漏洞 (USN-3490-1)	Nessus	Ubuntu Local Security Checks	2017/12/4	2024/8/27	critical
105115	Debian DLA-1199-1：thunderbird 安全更新	Nessus	Debian Local Security Checks	2017/12/11	2021/1/11	critical
104587	Debian DSA-4035-1：firefox-esr - 安全更新	Nessus	Debian Local Security Checks	2017/11/16	2021/1/4	critical
104635	Mozilla Firefox ESR < 52.5 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/11/16	2019/11/12	critical
104636	Mozilla Firefox < 57 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	2017/11/16	2019/11/12	critical
104698	Oracle Linux 6 / 7 : firefox (ELSA-2017-3247)	Nessus	Oracle Linux Local Security Checks	2017/11/20	2024/10/23	critical
104988	RHEL 6 / 7：thunderbird (RHSA-2017:3372)	Nessus	Red Hat Local Security Checks	2017/12/4	2024/11/5	critical
127356	NewStart CGSL MAIN 4.05：firefox 多个漏洞 (NS-SA-2019-0116)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2024/5/7	critical
127363	NewStart CGSL MAIN 4.05：thunderbird 多个漏洞 (NS-SA-2019-0119)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2024/5/7	critical
108820	GLSA-201803-14：Mozilla Thunderbird：多个漏洞	Nessus	Gentoo Local Security Checks	2018/4/4	2024/11/21	critical
700332	Mozilla Firefox ESR < 52.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/11/6	high
700322	Mozilla Firefox < 57 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/21	2019/3/6	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical